A Thief in the Night: vhand The vhand kernel daemon is actually two operations in a single package. The first scan targets pages and, if their pde_accessed bits are still clean, steals them; the second scan ages targeted pages. To age a page means to invalidate its current virtual address translation(s) in all processor TLBs and clear the access bit for the page in its hashtable entry (pde_accessed = 0). vhand steals a page when it discovers that the page has not been referenced since it was last scanned. It then requests a page-out and allocates a swap location if one does not already exist for the page. Pages are aged and stolen through their pregion  region vfd linkages. Figure 7-2 shows vhand's view of a pregion. Figure 7-2. Inside Each pregion 
In this simplified model we see that all the pages of the pregion are arranged in a circle, and their respective vfds appear as the numerals on the face of a clock. In our simple example, the pregion has 32 pages, sufficient to explain vhand operation. In the pregion structure, p_stealscan points to the next page in this pregion, which may be checked for parole. The p_agescan points to the next page vhand may age. When vhand enters a pregion, it is only allowed to scan 1/16 of the available pages. The p_stealscan must lag the position of the p_agescan by [(p_count/16) * handlaps]. Maintaining this lag assures that a process that still needs the aged page may access it before it is stolen. The larger the lag, the less likely vhand is to steal a page in current use. The next time the system points to this pregion, the next 1/16 of its pages may be scanned. Individual pregions are dual-linked in a systemwide list of all active pregions by their p_forw and p_back pointers The Linked pregion List The kernel follows this dual-linked list to find the next pregion to scan Figure 7-3 illustrates this concept. You can think of the operation as a two-level clock. The hands on the main clock are the system's agehand and stealhand. Inside each pregion are corresponding p_agescan and p_stealscan pointers. This is where the paging routine's name came from: vhand stands for the virtual hand pager. Figure 7-3. Linking All the pregions 
In order for all the pages of a region to be aged, the system's agehand would have to make 16 complete laps of the systemwide pregion list hence the term handlap. The larger the handlap value (maximum is 15), the greater the lag time between the vhand aging a page and being able to steal it. As memory pressure falls below gpgslim, the handlap's value is reduced until the p_stealscan is bumping into the p_agescan (it is never allowed to overtake it). Each time vhand is scheduled, it is given a quota of pages to age and steal: stealrate and agerate respectively. As it enters the pregion, it attempts to meet its quota. if the pregion doesn't have enough pages to meet the quota, stealhand simply moves on to the next pregion. Once the quota is reached, it stops. The current position of p_stealscan is where it starts next time this pregion is scanned. The same is true for the aging process The quotas are also adjusted as freemem loses ground with respect to gpgslim and desfree. By the time we reach desfree, handlaps are at a minimum, the quota is at its maximum (determined by the setting of targetcpu), and the paging is as aggressive as it can be. If this isn't enough to get us back into the good graces of the memory management system, then deactivation may do the trick. Programs begin with no pages in memory. As page faults occur, the requested pages are loaded; this is the essence of demand paging. As time goes by, a process may end up with a substantial number of its pages in-core. As other processes are scheduled, memory pressure may start to increase. When a program is deactivated, all of its pregions are marked as deactivated and moved to the front of the stealhand list. All of its pages may be paroled the next time vhand runs. As soon as we get above the desfree limit, we consider deactivated processes for reactivation. Even if we reactivate a large process, we may be able to stay above the limit, since pages are only reloaded on an on-demand basis. | 